What is the CVSS score of CVE-2025-63822?

CVE-2025-63822 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of SirenGPS are affected by CVE-2025-63822?

SirenGPS Android Application 2.19.44 contains a privilege escalation vulnerability enabling authenticated attackers to access and modify other users' personal data.

How to fix or mitigate CVE-2025-63822?

Within 24 hours, inventory all SirenGPS 2.19.44 installations and quantify affected users; audit backend API logs for cross-user data access anomalies. Within 7 days, implement enhanced monitoring on the vulnerable API endpoints to detect exploitation attempts, and communicate the vulnerability to users with password update recommendations; note that a detailed technical advisory is publicly available on GitHub, accelerating the time-to-exploit. Within 30 days, monitor the vendor for patch availability, evaluate alternative GPS solutions for migration planning, and deploy API-level compensating controls such as rate limiting and granular access logging on sensitive data endpoints.

SirenGPS CVE-2025-63822

EUVD-2025-210623 HIGH

Improper Access Control (CWE-284)

2026-08-05 mitre

GHSA-g8m2-9mph-q9gr

Authentication Bypass Google N A

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable API flaw requiring authenticated (PR:L) account; parameter substitution is trivially low complexity; no availability impact is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:56 vuln.today

CVSS changed

Aug 06, 2026 - 15:22 NVD

8.1 (None) 8.1 (HIGH)

CVE Published

Aug 05, 2026 - 00:00 cve.org

HIGH 8.1

CVE Published

Aug 05, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the requesting user is authorized to access the target user's data.

AnalysisAI

Unauthorized access to other users' personal data in SirenGPS Android Application 2.19.44 stems from the backend API failing to verify that a requesting user is authorized to act on the target user identifier supplied in API parameters. An authenticated attacker exploiting this horizontal privilege escalation can read and overwrite arbitrary users' personal information with only low-privilege access. No public exploit identified at time of analysis and EPSS is extremely low (0.15%, 5th percentile), but a detailed researcher advisory is publicly available on GitHub, lowering the bar for replication.

Technical ContextAI

The vulnerability is rooted in CWE-284 (Improper Access Control), specifically an Insecure Direct Object Reference (IDOR) pattern: the SirenGPS mobile application communicates with a backend API that accepts user identifier parameters in requests but performs no server-side validation confirming the session owner matches the target user. An attacker who authenticates normally can substitute any other user's identifier into these API calls to pivot horizontally across accounts. NVD CPE data is listed as n/a, indicating formal product enumeration has not been assigned; the affected product is the SirenGPS Android app (com.sirengps.mobile) version 2.19.44 distributed via Google Play. The CVSS vector AV:N/AC:L/PR:L confirms the flaw is reachable over the network with low attack complexity once authenticated, consistent with a missing server-side authorization gate on a REST or similar API endpoint.

RemediationAI

No vendor-released patch or fixed version has been identified at time of analysis; the references contain no vendor security advisory citing a remediated release. Users and organizations relying on SirenGPS should contact the vendor directly to inquire about a fix timeline. As a compensating control, administrators of the SirenGPS backend (if self-hosted) should enforce server-side authorization on all user-data endpoints by verifying the session token's associated user ID matches the requested user identifier before processing any read or write operation - simply rejecting mismatches eliminates the attack surface without functional impact for legitimate users. End-users on managed deployments have limited mitigations beyond reducing the personal information stored in the application. If the application is used in a corporate or fleet-tracking context, restrict account creation to minimize the number of valid identifiers an insider could enumerate. The Google Play listing is at https://play.google.com/store/apps/details?id=com.sirengps.mobile.